---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.10.0
  name: tenants.capsule.clastix.io
spec:
  conversion:
    strategy: Webhook
    webhook:
      clientConfig:
        service:
          name: capsule-webhook-service
          namespace: capsule-system
          path: /convert
      conversionReviewVersions:
        - v1beta1
        - v1beta2
  group: capsule.clastix.io
  names:
    kind: Tenant
    listKind: TenantList
    plural: tenants
    shortNames:
      - tnt
    singular: tenant
  scope: Cluster
  versions:
    - additionalPrinterColumns:
        - description: The actual state of the Tenant
          jsonPath: .status.state
          name: State
          type: string
        - description: The max amount of Namespaces can be created
          jsonPath: .spec.namespaceOptions.quota
          name: Namespace quota
          type: integer
        - description: The total amount of Namespaces in use
          jsonPath: .status.size
          name: Namespace count
          type: integer
        - description: Node Selector applied to Pods
          jsonPath: .spec.nodeSelector
          name: Node selector
          type: string
        - description: Age
          jsonPath: .metadata.creationTimestamp
          name: Age
          type: date
      name: v1beta1
      schema:
        openAPIV3Schema:
          description: Tenant is the Schema for the tenants API.
          properties:
            apiVersion:
              description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
              type: string
            kind:
              description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
              type: string
            metadata:
              type: object
            spec:
              description: TenantSpec defines the desired state of Tenant.
              properties:
                additionalRoleBindings:
                  description: Specifies additional RoleBindings assigned to the Tenant.
                    Capsule will ensure that all namespaces in the Tenant always contain
                    the RoleBinding for the given ClusterRole. Optional.
                  items:
                    properties:
                      clusterRoleName:
                        type: string
                      subjects:
                        description: kubebuilder:validation:Minimum=1
                        items:
                          description: Subject contains a reference to the object or
                            user identities a role binding applies to.  This can either
                            hold a direct API object reference, or a value for non-objects
                            such as user and group names.
                          properties:
                            apiGroup:
                              description: APIGroup holds the API group of the referenced
                                subject. Defaults to "" for ServiceAccount subjects.
                                Defaults to "rbac.authorization.k8s.io" for User and
                                Group subjects.
                              type: string
                            kind:
                              description: Kind of object being referenced. Values defined
                                by this API group are "User", "Group", and "ServiceAccount".
                                If the Authorizer does not recognized the kind value,
                                the Authorizer should report an error.
                              type: string
                            name:
                              description: Name of the object being referenced.
                              type: string
                            namespace:
                              description: Namespace of the referenced object.  If the
                                object kind is non-namespace, such as "User" or "Group",
                                and this value is not empty the Authorizer should report
                                an error.
                              type: string
                          required:
                            - kind
                            - name
                          type: object
                          x-kubernetes-map-type: atomic
                        type: array
                    required:
                      - clusterRoleName
                      - subjects
                    type: object
                  type: array
                containerRegistries:
                  description: Specifies the trusted Image Registries assigned to the
                    Tenant. Capsule assures that all Pods resources created in the Tenant
                    can use only one of the allowed trusted registries. Optional.
                  properties:
                    allowed:
                      items:
                        type: string
                      type: array
                    allowedRegex:
                      type: string
                  type: object
                imagePullPolicies:
                  description: Specify the allowed values for the imagePullPolicies
                    option in Pod resources. Capsule assures that all Pod resources
                    created in the Tenant can use only one of the allowed policy. Optional.
                  items:
                    enum:
                      - Always
                      - Never
                      - IfNotPresent
                    type: string
                  type: array
                ingressOptions:
                  description: Specifies options for the Ingress resources, such as
                    allowed hostnames and IngressClass. Optional.
                  properties:
                    allowedClasses:
                      description: Specifies the allowed IngressClasses assigned to
                        the Tenant. Capsule assures that all Ingress resources created
                        in the Tenant can use only one of the allowed IngressClasses.
                        Optional.
                      properties:
                        allowed:
                          items:
                            type: string
                          type: array
                        allowedRegex:
                          type: string
                      type: object
                    allowedHostnames:
                      description: Specifies the allowed hostnames in Ingresses for
                        the given Tenant. Capsule assures that all Ingress resources
                        created in the Tenant can use only one of the allowed hostnames.
                        Optional.
                      properties:
                        allowed:
                          items:
                            type: string
                          type: array
                        allowedRegex:
                          type: string
                      type: object
                    hostnameCollisionScope:
                      default: Disabled
                      description: "Defines the scope of hostname collision check performed
                      when Tenant Owners create Ingress with allowed hostnames. \n
                      - Cluster: disallow the creation of an Ingress if the pair hostname
                      and path is already used across the Namespaces managed by Capsule.
                      \n - Tenant: disallow the creation of an Ingress if the pair
                      hostname and path is already used across the Namespaces of the
                      Tenant. \n - Namespace: disallow the creation of an Ingress
                      if the pair hostname and path is already used in the Ingress
                      Namespace. \n Optional."
                      enum:
                        - Cluster
                        - Tenant
                        - Namespace
                        - Disabled
                      type: string
                  type: object
                limitRanges:
                  description: Specifies the resource min/max usage restrictions to
                    the Tenant. The assigned values are inherited by any namespace created
                    in the Tenant. Optional.
                  properties:
                    items:
                      items:
                        description: LimitRangeSpec defines a min/max usage limit for
                          resources that match on kind.
                        properties:
                          limits:
                            description: Limits is the list of LimitRangeItem objects
                              that are enforced.
                            items:
                              description: LimitRangeItem defines a min/max usage limit
                                for any resource that matches on kind.
                              properties:
                                default:
                                  additionalProperties:
                                    anyOf:
                                      - type: integer
                                      - type: string
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  description: Default resource requirement limit value
                                    by resource name if resource limit is omitted.
                                  type: object
                                defaultRequest:
                                  additionalProperties:
                                    anyOf:
                                      - type: integer
                                      - type: string
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  description: DefaultRequest is the default resource
                                    requirement request value by resource name if resource
                                    request is omitted.
                                  type: object
                                max:
                                  additionalProperties:
                                    anyOf:
                                      - type: integer
                                      - type: string
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  description: Max usage constraints on this kind by
                                    resource name.
                                  type: object
                                maxLimitRequestRatio:
                                  additionalProperties:
                                    anyOf:
                                      - type: integer
                                      - type: string
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  description: MaxLimitRequestRatio if specified, the
                                    named resource must have a request and limit that
                                    are both non-zero where limit divided by request
                                    is less than or equal to the enumerated value; this
                                    represents the max burst for the named resource.
                                  type: object
                                min:
                                  additionalProperties:
                                    anyOf:
                                      - type: integer
                                      - type: string
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  description: Min usage constraints on this kind by
                                    resource name.
                                  type: object
                                type:
                                  description: Type of resource that this limit applies
                                    to.
                                  type: string
                              required:
                                - type
                              type: object
                            type: array
                        required:
                          - limits
                        type: object
                      type: array
                  type: object
                namespaceOptions:
                  description: Specifies options for the Namespaces, such as additional
                    metadata or maximum number of namespaces allowed for that Tenant.
                    Once the namespace quota assigned to the Tenant has been reached,
                    the Tenant owner cannot create further namespaces. Optional.
                  properties:
                    additionalMetadata:
                      description: Specifies additional labels and annotations the Capsule
                        operator places on any Namespace resource in the Tenant. Optional.
                      properties:
                        annotations:
                          additionalProperties:
                            type: string
                          type: object
                        labels:
                          additionalProperties:
                            type: string
                          type: object
                      type: object
                    quota:
                      description: Specifies the maximum number of namespaces allowed
                        for that Tenant. Once the namespace quota assigned to the Tenant
                        has been reached, the Tenant owner cannot create further namespaces.
                        Optional.
                      format: int32
                      minimum: 1
                      type: integer
                  type: object
                networkPolicies:
                  description: Specifies the NetworkPolicies assigned to the Tenant.
                    The assigned NetworkPolicies are inherited by any namespace created
                    in the Tenant. Optional.
                  properties:
                    items:
                      items:
                        description: NetworkPolicySpec provides the specification of
                          a NetworkPolicy
                        properties:
                          egress:
                            description: List of egress rules to be applied to the selected
                              pods. Outgoing traffic is allowed if there are no NetworkPolicies
                              selecting the pod (and cluster policy otherwise allows
                              the traffic), OR if the traffic matches at least one egress
                              rule across all of the NetworkPolicy objects whose podSelector
                              matches the pod. If this field is empty then this NetworkPolicy
                              limits all outgoing traffic (and serves solely to ensure
                              that the pods it selects are isolated by default). This
                              field is beta-level in 1.8
                            items:
                              description: NetworkPolicyEgressRule describes a particular
                                set of traffic that is allowed out of pods matched by
                                a NetworkPolicySpec's podSelector. The traffic must
                                match both ports and to. This type is beta-level in
                                1.8
                              properties:
                                ports:
                                  description: List of destination ports for outgoing
                                    traffic. Each item in this list is combined using
                                    a logical OR. If this field is empty or missing,
                                    this rule matches all ports (traffic not restricted
                                    by port). If this field is present and contains
                                    at least one item, then this rule allows traffic
                                    only if the traffic matches at least one port in
                                    the list.
                                  items:
                                    description: NetworkPolicyPort describes a port
                                      to allow traffic on
                                    properties:
                                      endPort:
                                        description: If set, indicates that the range
                                          of ports from port to endPort, inclusive,
                                          should be allowed by the policy. This field
                                          cannot be defined if the port field is not
                                          defined or if the port field is defined as
                                          a named (string) port. The endPort must be
                                          equal or greater than port. This feature is
                                          in Beta state and is enabled by default. It
                                          can be disabled using the Feature Gate "NetworkPolicyEndPort".
                                        format: int32
                                        type: integer
                                      port:
                                        anyOf:
                                          - type: integer
                                          - type: string
                                        description: The port on the given protocol.
                                          This can either be a numerical or named port
                                          on a pod. If this field is not provided, this
                                          matches all port names and numbers. If present,
                                          only traffic on the specified protocol AND
                                          port will be matched.
                                        x-kubernetes-int-or-string: true
                                      protocol:
                                        default: TCP
                                        description: The protocol (TCP, UDP, or SCTP)
                                          which traffic must match. If not specified,
                                          this field defaults to TCP.
                                        type: string
                                    type: object
                                  type: array
                                to:
                                  description: List of destinations for outgoing traffic
                                    of pods selected for this rule. Items in this list
                                    are combined using a logical OR operation. If this
                                    field is empty or missing, this rule matches all
                                    destinations (traffic not restricted by destination).
                                    If this field is present and contains at least one
                                    item, this rule allows traffic only if the traffic
                                    matches at least one item in the to list.
                                  items:
                                    description: NetworkPolicyPeer describes a peer
                                      to allow traffic to/from. Only certain combinations
                                      of fields are allowed
                                    properties:
                                      ipBlock:
                                        description: IPBlock defines policy on a particular
                                          IPBlock. If this field is set then neither
                                          of the other fields can be.
                                        properties:
                                          cidr:
                                            description: CIDR is a string representing
                                              the IP Block Valid examples are "192.168.1.1/24"
                                              or "2001:db9::/64"
                                            type: string
                                          except:
                                            description: Except is a slice of CIDRs
                                              that should not be included within an
                                              IP Block Valid examples are "192.168.1.1/24"
                                              or "2001:db9::/64" Except values will
                                              be rejected if they are outside the CIDR
                                              range
                                            items:
                                              type: string
                                            type: array
                                        required:
                                          - cidr
                                        type: object
                                      namespaceSelector:
                                        description: "Selects Namespaces using cluster-scoped
                                        labels. This field follows standard label
                                        selector semantics; if present but empty,
                                        it selects all namespaces. \n If PodSelector
                                        is also set, then the NetworkPolicyPeer as
                                        a whole selects the Pods matching PodSelector
                                        in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects all Pods in the Namespaces
                                        selected by NamespaceSelector."
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list
                                              of label selector requirements. The requirements
                                              are ANDed.
                                            items:
                                              description: A label selector requirement
                                                is a selector that contains values,
                                                a key, and an operator that relates
                                                the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key
                                                    that the selector applies to.
                                                  type: string
                                                operator:
                                                  description: operator represents a
                                                    key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists
                                                    and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: values is an array of
                                                    string values. If the operator is
                                                    In or NotIn, the values array must
                                                    be non-empty. If the operator is
                                                    Exists or DoesNotExist, the values
                                                    array must be empty. This array
                                                    is replaced during a strategic merge
                                                    patch.
                                                  items:
                                                    type: string
                                                  type: array
                                              required:
                                                - key
                                                - operator
                                              type: object
                                            type: array
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: matchLabels is a map of {key,value}
                                              pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions,
                                              whose key field is "key", the operator
                                              is "In", and the values array contains
                                              only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                      podSelector:
                                        description: "This is a label selector which
                                        selects Pods. This field follows standard
                                        label selector semantics; if present but empty,
                                        it selects all pods. \n If NamespaceSelector
                                        is also set, then the NetworkPolicyPeer as
                                        a whole selects the Pods matching PodSelector
                                        in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects the Pods matching PodSelector
                                        in the policy's own Namespace."
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list
                                              of label selector requirements. The requirements
                                              are ANDed.
                                            items:
                                              description: A label selector requirement
                                                is a selector that contains values,
                                                a key, and an operator that relates
                                                the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key
                                                    that the selector applies to.
                                                  type: string
                                                operator:
                                                  description: operator represents a
                                                    key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists
                                                    and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: values is an array of
                                                    string values. If the operator is
                                                    In or NotIn, the values array must
                                                    be non-empty. If the operator is
                                                    Exists or DoesNotExist, the values
                                                    array must be empty. This array
                                                    is replaced during a strategic merge
                                                    patch.
                                                  items:
                                                    type: string
                                                  type: array
                                              required:
                                                - key
                                                - operator
                                              type: object
                                            type: array
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: matchLabels is a map of {key,value}
                                              pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions,
                                              whose key field is "key", the operator
                                              is "In", and the values array contains
                                              only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                    type: object
                                  type: array
                              type: object
                            type: array
                          ingress:
                            description: List of ingress rules to be applied to the
                              selected pods. Traffic is allowed to a pod if there are
                              no NetworkPolicies selecting the pod (and cluster policy
                              otherwise allows the traffic), OR if the traffic source
                              is the pod's local node, OR if the traffic matches at
                              least one ingress rule across all of the NetworkPolicy
                              objects whose podSelector matches the pod. If this field
                              is empty then this NetworkPolicy does not allow any traffic
                              (and serves solely to ensure that the pods it selects
                              are isolated by default)
                            items:
                              description: NetworkPolicyIngressRule describes a particular
                                set of traffic that is allowed to the pods matched by
                                a NetworkPolicySpec's podSelector. The traffic must
                                match both ports and from.
                              properties:
                                from:
                                  description: List of sources which should be able
                                    to access the pods selected for this rule. Items
                                    in this list are combined using a logical OR operation.
                                    If this field is empty or missing, this rule matches
                                    all sources (traffic not restricted by source).
                                    If this field is present and contains at least one
                                    item, this rule allows traffic only if the traffic
                                    matches at least one item in the from list.
                                  items:
                                    description: NetworkPolicyPeer describes a peer
                                      to allow traffic to/from. Only certain combinations
                                      of fields are allowed
                                    properties:
                                      ipBlock:
                                        description: IPBlock defines policy on a particular
                                          IPBlock. If this field is set then neither
                                          of the other fields can be.
                                        properties:
                                          cidr:
                                            description: CIDR is a string representing
                                              the IP Block Valid examples are "192.168.1.1/24"
                                              or "2001:db9::/64"
                                            type: string
                                          except:
                                            description: Except is a slice of CIDRs
                                              that should not be included within an
                                              IP Block Valid examples are "192.168.1.1/24"
                                              or "2001:db9::/64" Except values will
                                              be rejected if they are outside the CIDR
                                              range
                                            items:
                                              type: string
                                            type: array
                                        required:
                                          - cidr
                                        type: object
                                      namespaceSelector:
                                        description: "Selects Namespaces using cluster-scoped
                                        labels. This field follows standard label
                                        selector semantics; if present but empty,
                                        it selects all namespaces. \n If PodSelector
                                        is also set, then the NetworkPolicyPeer as
                                        a whole selects the Pods matching PodSelector
                                        in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects all Pods in the Namespaces
                                        selected by NamespaceSelector."
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list
                                              of label selector requirements. The requirements
                                              are ANDed.
                                            items:
                                              description: A label selector requirement
                                                is a selector that contains values,
                                                a key, and an operator that relates
                                                the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key
                                                    that the selector applies to.
                                                  type: string
                                                operator:
                                                  description: operator represents a
                                                    key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists
                                                    and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: values is an array of
                                                    string values. If the operator is
                                                    In or NotIn, the values array must
                                                    be non-empty. If the operator is
                                                    Exists or DoesNotExist, the values
                                                    array must be empty. This array
                                                    is replaced during a strategic merge
                                                    patch.
                                                  items:
                                                    type: string
                                                  type: array
                                              required:
                                                - key
                                                - operator
                                              type: object
                                            type: array
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: matchLabels is a map of {key,value}
                                              pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions,
                                              whose key field is "key", the operator
                                              is "In", and the values array contains
                                              only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                      podSelector:
                                        description: "This is a label selector which
                                        selects Pods. This field follows standard
                                        label selector semantics; if present but empty,
                                        it selects all pods. \n If NamespaceSelector
                                        is also set, then the NetworkPolicyPeer as
                                        a whole selects the Pods matching PodSelector
                                        in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects the Pods matching PodSelector
                                        in the policy's own Namespace."
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list
                                              of label selector requirements. The requirements
                                              are ANDed.
                                            items:
                                              description: A label selector requirement
                                                is a selector that contains values,
                                                a key, and an operator that relates
                                                the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key
                                                    that the selector applies to.
                                                  type: string
                                                operator:
                                                  description: operator represents a
                                                    key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists
                                                    and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: values is an array of
                                                    string values. If the operator is
                                                    In or NotIn, the values array must
                                                    be non-empty. If the operator is
                                                    Exists or DoesNotExist, the values
                                                    array must be empty. This array
                                                    is replaced during a strategic merge
                                                    patch.
                                                  items:
                                                    type: string
                                                  type: array
                                              required:
                                                - key
                                                - operator
                                              type: object
                                            type: array
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: matchLabels is a map of {key,value}
                                              pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions,
                                              whose key field is "key", the operator
                                              is "In", and the values array contains
                                              only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                    type: object
                                  type: array
                                ports:
                                  description: List of ports which should be made accessible
                                    on the pods selected for this rule. Each item in
                                    this list is combined using a logical OR. If this
                                    field is empty or missing, this rule matches all
                                    ports (traffic not restricted by port). If this
                                    field is present and contains at least one item,
                                    then this rule allows traffic only if the traffic
                                    matches at least one port in the list.
                                  items:
                                    description: NetworkPolicyPort describes a port
                                      to allow traffic on
                                    properties:
                                      endPort:
                                        description: If set, indicates that the range
                                          of ports from port to endPort, inclusive,
                                          should be allowed by the policy. This field
                                          cannot be defined if the port field is not
                                          defined or if the port field is defined as
                                          a named (string) port. The endPort must be
                                          equal or greater than port. This feature is
                                          in Beta state and is enabled by default. It
                                          can be disabled using the Feature Gate "NetworkPolicyEndPort".
                                        format: int32
                                        type: integer
                                      port:
                                        anyOf:
                                          - type: integer
                                          - type: string
                                        description: The port on the given protocol.
                                          This can either be a numerical or named port
                                          on a pod. If this field is not provided, this
                                          matches all port names and numbers. If present,
                                          only traffic on the specified protocol AND
                                          port will be matched.
                                        x-kubernetes-int-or-string: true
                                      protocol:
                                        default: TCP
                                        description: The protocol (TCP, UDP, or SCTP)
                                          which traffic must match. If not specified,
                                          this field defaults to TCP.
                                        type: string
                                    type: object
                                  type: array
                              type: object
                            type: array
                          podSelector:
                            description: Selects the pods to which this NetworkPolicy
                              object applies. The array of ingress rules is applied
                              to any pods selected by this field. Multiple network policies
                              can select the same set of pods. In this case, the ingress
                              rules for each are combined additively. This field is
                              NOT optional and follows standard label selector semantics.
                              An empty podSelector matches all pods in this namespace.
                            properties:
                              matchExpressions:
                                description: matchExpressions is a list of label selector
                                  requirements. The requirements are ANDed.
                                items:
                                  description: A label selector requirement is a selector
                                    that contains values, a key, and an operator that
                                    relates the key and values.
                                  properties:
                                    key:
                                      description: key is the label key that the selector
                                        applies to.
                                      type: string
                                    operator:
                                      description: operator represents a key's relationship
                                        to a set of values. Valid operators are In,
                                        NotIn, Exists and DoesNotExist.
                                      type: string
                                    values:
                                      description: values is an array of string values.
                                        If the operator is In or NotIn, the values array
                                        must be non-empty. If the operator is Exists
                                        or DoesNotExist, the values array must be empty.
                                        This array is replaced during a strategic merge
                                        patch.
                                      items:
                                        type: string
                                      type: array
                                  required:
                                    - key
                                    - operator
                                  type: object
                                type: array
                              matchLabels:
                                additionalProperties:
                                  type: string
                                description: matchLabels is a map of {key,value} pairs.
                                  A single {key,value} in the matchLabels map is equivalent
                                  to an element of matchExpressions, whose key field
                                  is "key", the operator is "In", and the values array
                                  contains only "value". The requirements are ANDed.
                                type: object
                            type: object
                            x-kubernetes-map-type: atomic
                          policyTypes:
                            description: List of rule types that the NetworkPolicy relates
                              to. Valid options are ["Ingress"], ["Egress"], or ["Ingress",
                              "Egress"]. If this field is not specified, it will default
                              based on the existence of Ingress or Egress rules; policies
                              that contain an Egress section are assumed to affect Egress,
                              and all policies (whether or not they contain an Ingress
                              section) are assumed to affect Ingress. If you want to
                              write an egress-only policy, you must explicitly specify
                              policyTypes [ "Egress" ]. Likewise, if you want to write
                              a policy that specifies that no egress is allowed, you
                              must specify a policyTypes value that include "Egress"
                              (since such a policy would not include an Egress section
                              and would otherwise default to just [ "Ingress" ]). This
                              field is beta-level in 1.8
                            items:
                              description: PolicyType string describes the NetworkPolicy
                                type This type is beta-level in 1.8
                              type: string
                            type: array
                        required:
                          - podSelector
                        type: object
                      type: array
                  type: object
                nodeSelector:
                  additionalProperties:
                    type: string
                  description: Specifies the label to control the placement of pods
                    on a given pool of worker nodes. All namespaces created within the
                    Tenant will have the node selector annotation. This annotation tells
                    the Kubernetes scheduler to place pods on the nodes having the selector
                    label. Optional.
                  type: object
                owners:
                  description: Specifies the owners of the Tenant. Mandatory.
                  items:
                    properties:
                      kind:
                        description: Kind of tenant owner. Possible values are "User",
                          "Group", and "ServiceAccount"
                        enum:
                          - User
                          - Group
                          - ServiceAccount
                        type: string
                      name:
                        description: Name of tenant owner.
                        type: string
                      proxySettings:
                        description: Proxy settings for tenant owner.
                        items:
                          properties:
                            kind:
                              enum:
                                - Nodes
                                - StorageClasses
                                - IngressClasses
                                - PriorityClasses
                              type: string
                            operations:
                              items:
                                enum:
                                  - List
                                  - Update
                                  - Delete
                                type: string
                              type: array
                          required:
                            - kind
                            - operations
                          type: object
                        type: array
                    required:
                      - kind
                      - name
                    type: object
                  type: array
                podOptions:
                  description: Specifies options for the Pod, such as additional metadata. Optional.
                  properties:
                    additionalMetadata:
                      description: Specifies additional labels and annotations the Capsule operator places on any Service resource in the Tenant. Optional.
                      properties:
                        annotations:
                          additionalProperties:
                            type: string
                          type: object
                        labels:
                          additionalProperties:
                            type: string
                          type: object
                      type: object
                  type: object
                priorityClasses:
                  description: Specifies the allowed priorityClasses assigned to the
                    Tenant. Capsule assures that all Pods resources created in the Tenant
                    can use only one of the allowed PriorityClasses. Optional.
                  properties:
                    allowed:
                      items:
                        type: string
                      type: array
                    allowedRegex:
                      type: string
                  type: object
                resourceQuotas:
                  description: Specifies a list of ResourceQuota resources assigned
                    to the Tenant. The assigned values are inherited by any namespace
                    created in the Tenant. The Capsule operator aggregates ResourceQuota
                    at Tenant level, so that the hard quota is never crossed for the
                    given Tenant. This permits the Tenant owner to consume resources
                    in the Tenant regardless of the namespace. Optional.
                  properties:
                    items:
                      items:
                        description: ResourceQuotaSpec defines the desired hard limits
                          to enforce for Quota.
                        properties:
                          hard:
                            additionalProperties:
                              anyOf:
                                - type: integer
                                - type: string
                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                              x-kubernetes-int-or-string: true
                            description: 'hard is the set of desired hard limits for
                            each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
                            type: object
                          scopeSelector:
                            description: scopeSelector is also a collection of filters
                              like scopes that must match each object tracked by a quota
                              but expressed using ScopeSelectorOperator in combination
                              with possible values. For a resource to match, both scopes
                              AND scopeSelector (if specified in spec), must be matched.
                            properties:
                              matchExpressions:
                                description: A list of scope selector requirements by
                                  scope of the resources.
                                items:
                                  description: A scoped-resource selector requirement
                                    is a selector that contains values, a scope name,
                                    and an operator that relates the scope name and
                                    values.
                                  properties:
                                    operator:
                                      description: Represents a scope's relationship
                                        to a set of values. Valid operators are In,
                                        NotIn, Exists, DoesNotExist.
                                      type: string
                                    scopeName:
                                      description: The name of the scope that the selector
                                        applies to.
                                      type: string
                                    values:
                                      description: An array of string values. If the
                                        operator is In or NotIn, the values array must
                                        be non-empty. If the operator is Exists or DoesNotExist,
                                        the values array must be empty. This array is
                                        replaced during a strategic merge patch.
                                      items:
                                        type: string
                                      type: array
                                  required:
                                    - operator
                                    - scopeName
                                  type: object
                                type: array
                            type: object
                            x-kubernetes-map-type: atomic
                          scopes:
                            description: A collection of filters that must match each
                              object tracked by a quota. If not specified, the quota
                              matches all objects.
                            items:
                              description: A ResourceQuotaScope defines a filter that
                                must match each object tracked by a quota
                              type: string
                            type: array
                        type: object
                      type: array
                    scope:
                      default: Tenant
                      description: Define if the Resource Budget should compute resource
                        across all Namespaces in the Tenant or individually per cluster.
                        Default is Tenant
                      enum:
                        - Tenant
                        - Namespace
                      type: string
                  type: object
                serviceOptions:
                  description: Specifies options for the Service, such as additional
                    metadata or block of certain type of Services. Optional.
                  properties:
                    additionalMetadata:
                      description: Specifies additional labels and annotations the Capsule
                        operator places on any Service resource in the Tenant. Optional.
                      properties:
                        annotations:
                          additionalProperties:
                            type: string
                          type: object
                        labels:
                          additionalProperties:
                            type: string
                          type: object
                      type: object
                    allowedServices:
                      description: Block or deny certain type of Services. Optional.
                      properties:
                        externalName:
                          default: true
                          description: Specifies if ExternalName service type resources
                            are allowed for the Tenant. Default is true. Optional.
                          type: boolean
                        loadBalancer:
                          default: true
                          description: Specifies if LoadBalancer service type resources
                            are allowed for the Tenant. Default is true. Optional.
                          type: boolean
                        nodePort:
                          default: true
                          description: Specifies if NodePort service type resources
                            are allowed for the Tenant. Default is true. Optional.
                          type: boolean
                      type: object
                    externalIPs:
                      description: Specifies the external IPs that can be used in Services
                        with type ClusterIP. An empty list means no IPs are allowed.
                        Optional.
                      properties:
                        allowed:
                          items:
                            pattern: ^([0-9]{1,3}.){3}[0-9]{1,3}(/([0-9]|[1-2][0-9]|3[0-2]))?$
                            type: string
                          type: array
                      required:
                        - allowed
                      type: object
                  type: object
                storageClasses:
                  description: Specifies the allowed StorageClasses assigned to the
                    Tenant. Capsule assures that all PersistentVolumeClaim resources
                    created in the Tenant can use only one of the allowed StorageClasses.
                    Optional.
                  properties:
                    allowed:
                      items:
                        type: string
                      type: array
                    allowedRegex:
                      type: string
                  type: object
              required:
                - owners
              type: object
            status:
              description: Returns the observed state of the Tenant.
              properties:
                namespaces:
                  description: List of namespaces assigned to the Tenant.
                  items:
                    type: string
                  type: array
                size:
                  description: How many namespaces are assigned to the Tenant.
                  type: integer
                state:
                  default: Active
                  description: The operational state of the Tenant. Possible values
                    are "Active", "Cordoned".
                  enum:
                    - Cordoned
                    - Active
                  type: string
              required:
                - size
                - state
              type: object
          type: object
      served: true
      storage: false
      subresources:
        status: {}
    - additionalPrinterColumns:
        - description: The actual state of the Tenant
          jsonPath: .status.state
          name: State
          type: string
        - description: The max amount of Namespaces can be created
          jsonPath: .spec.namespaceOptions.quota
          name: Namespace quota
          type: integer
        - description: The total amount of Namespaces in use
          jsonPath: .status.size
          name: Namespace count
          type: integer
        - description: Node Selector applied to Pods
          jsonPath: .spec.nodeSelector
          name: Node selector
          type: string
        - description: Age
          jsonPath: .metadata.creationTimestamp
          name: Age
          type: date
      name: v1beta2
      schema:
        openAPIV3Schema:
          description: Tenant is the Schema for the tenants API.
          properties:
            apiVersion:
              description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
              type: string
            kind:
              description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
              type: string
            metadata:
              type: object
            spec:
              description: TenantSpec defines the desired state of Tenant.
              properties:
                additionalRoleBindings:
                  description: Specifies additional RoleBindings assigned to the Tenant.
                    Capsule will ensure that all namespaces in the Tenant always contain
                    the RoleBinding for the given ClusterRole. Optional.
                  items:
                    properties:
                      clusterRoleName:
                        type: string
                      subjects:
                        description: kubebuilder:validation:Minimum=1
                        items:
                          description: Subject contains a reference to the object or
                            user identities a role binding applies to.  This can either
                            hold a direct API object reference, or a value for non-objects
                            such as user and group names.
                          properties:
                            apiGroup:
                              description: APIGroup holds the API group of the referenced
                                subject. Defaults to "" for ServiceAccount subjects.
                                Defaults to "rbac.authorization.k8s.io" for User and
                                Group subjects.
                              type: string
                            kind:
                              description: Kind of object being referenced. Values defined
                                by this API group are "User", "Group", and "ServiceAccount".
                                If the Authorizer does not recognized the kind value,
                                the Authorizer should report an error.
                              type: string
                            name:
                              description: Name of the object being referenced.
                              type: string
                            namespace:
                              description: Namespace of the referenced object.  If the
                                object kind is non-namespace, such as "User" or "Group",
                                and this value is not empty the Authorizer should report
                                an error.
                              type: string
                          required:
                            - kind
                            - name
                          type: object
                          x-kubernetes-map-type: atomic
                        type: array
                    required:
                      - clusterRoleName
                      - subjects
                    type: object
                  type: array
                containerRegistries:
                  description: Specifies the trusted Image Registries assigned to the
                    Tenant. Capsule assures that all Pods resources created in the Tenant
                    can use only one of the allowed trusted registries. Optional.
                  properties:
                    allowed:
                      items:
                        type: string
                      type: array
                    allowedRegex:
                      type: string
                  type: object
                cordoned:
                  description: Toggling the Tenant resources cordoning, when enable
                    resources cannot be deleted.
                  type: boolean
                imagePullPolicies:
                  description: Specify the allowed values for the imagePullPolicies
                    option in Pod resources. Capsule assures that all Pod resources
                    created in the Tenant can use only one of the allowed policy. Optional.
                  items:
                    enum:
                      - Always
                      - Never
                      - IfNotPresent
                    type: string
                  type: array
                ingressOptions:
                  description: Specifies options for the Ingress resources, such as
                    allowed hostnames and IngressClass. Optional.
                  properties:
                    allowWildcardHostnames:
                      description: Toggles the ability for Ingress resources created
                        in a Tenant to have a hostname wildcard.
                      type: boolean
                    allowedClasses:
                      description: Specifies the allowed IngressClasses assigned to
                        the Tenant. Capsule assures that all Ingress resources created
                        in the Tenant can use only one of the allowed IngressClasses.
                        A default value can be specified, and all the Ingress resources
                        created will inherit the declared class. Optional.
                      properties:
                        allowed:
                          items:
                            type: string
                          type: array
                        allowedRegex:
                          type: string
                        default:
                          type: string
                        matchExpressions:
                          description: matchExpressions is a list of label selector
                            requirements. The requirements are ANDed.
                          items:
                            description: A label selector requirement is a selector
                              that contains values, a key, and an operator that relates
                              the key and values.
                            properties:
                              key:
                                description: key is the label key that the selector
                                  applies to.
                                type: string
                              operator:
                                description: operator represents a key's relationship
                                  to a set of values. Valid operators are In, NotIn,
                                  Exists and DoesNotExist.
                                type: string
                              values:
                                description: values is an array of string values. If
                                  the operator is In or NotIn, the values array must
                                  be non-empty. If the operator is Exists or DoesNotExist,
                                  the values array must be empty. This array is replaced
                                  during a strategic merge patch.
                                items:
                                  type: string
                                type: array
                            required:
                              - key
                              - operator
                            type: object
                          type: array
                        matchLabels:
                          additionalProperties:
                            type: string
                          description: matchLabels is a map of {key,value} pairs. A
                            single {key,value} in the matchLabels map is equivalent
                            to an element of matchExpressions, whose key field is "key",
                            the operator is "In", and the values array contains only
                            "value". The requirements are ANDed.
                          type: object
                      type: object
                      x-kubernetes-map-type: atomic
                    allowedHostnames:
                      description: Specifies the allowed hostnames in Ingresses for
                        the given Tenant. Capsule assures that all Ingress resources
                        created in the Tenant can use only one of the allowed hostnames.
                        Optional.
                      properties:
                        allowed:
                          items:
                            type: string
                          type: array
                        allowedRegex:
                          type: string
                      type: object
                    hostnameCollisionScope:
                      default: Disabled
                      description: "Defines the scope of hostname collision check performed
                      when Tenant Owners create Ingress with allowed hostnames. \n
                      - Cluster: disallow the creation of an Ingress if the pair hostname
                      and path is already used across the Namespaces managed by Capsule.
                      \n - Tenant: disallow the creation of an Ingress if the pair
                      hostname and path is already used across the Namespaces of the
                      Tenant. \n - Namespace: disallow the creation of an Ingress
                      if the pair hostname and path is already used in the Ingress
                      Namespace. \n Optional."
                      enum:
                        - Cluster
                        - Tenant
                        - Namespace
                        - Disabled
                      type: string
                  type: object
                limitRanges:
                  description: Specifies the resource min/max usage restrictions to
                    the Tenant. The assigned values are inherited by any namespace created
                    in the Tenant. Optional.
                  properties:
                    items:
                      items:
                        description: LimitRangeSpec defines a min/max usage limit for
                          resources that match on kind.
                        properties:
                          limits:
                            description: Limits is the list of LimitRangeItem objects
                              that are enforced.
                            items:
                              description: LimitRangeItem defines a min/max usage limit
                                for any resource that matches on kind.
                              properties:
                                default:
                                  additionalProperties:
                                    anyOf:
                                      - type: integer
                                      - type: string
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  description: Default resource requirement limit value
                                    by resource name if resource limit is omitted.
                                  type: object
                                defaultRequest:
                                  additionalProperties:
                                    anyOf:
                                      - type: integer
                                      - type: string
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  description: DefaultRequest is the default resource
                                    requirement request value by resource name if resource
                                    request is omitted.
                                  type: object
                                max:
                                  additionalProperties:
                                    anyOf:
                                      - type: integer
                                      - type: string
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  description: Max usage constraints on this kind by
                                    resource name.
                                  type: object
                                maxLimitRequestRatio:
                                  additionalProperties:
                                    anyOf:
                                      - type: integer
                                      - type: string
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  description: MaxLimitRequestRatio if specified, the
                                    named resource must have a request and limit that
                                    are both non-zero where limit divided by request
                                    is less than or equal to the enumerated value; this
                                    represents the max burst for the named resource.
                                  type: object
                                min:
                                  additionalProperties:
                                    anyOf:
                                      - type: integer
                                      - type: string
                                    pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                    x-kubernetes-int-or-string: true
                                  description: Min usage constraints on this kind by
                                    resource name.
                                  type: object
                                type:
                                  description: Type of resource that this limit applies
                                    to.
                                  type: string
                              required:
                                - type
                              type: object
                            type: array
                        required:
                          - limits
                        type: object
                      type: array
                  type: object
                namespaceOptions:
                  description: Specifies options for the Namespaces, such as additional
                    metadata or maximum number of namespaces allowed for that Tenant.
                    Once the namespace quota assigned to the Tenant has been reached,
                    the Tenant owner cannot create further namespaces. Optional.
                  properties:
                    additionalMetadata:
                      description: Specifies additional labels and annotations the Capsule
                        operator places on any Namespace resource in the Tenant. Optional.
                      properties:
                        annotations:
                          additionalProperties:
                            type: string
                          type: object
                        labels:
                          additionalProperties:
                            type: string
                          type: object
                      type: object
                    forbiddenAnnotations:
                      description: Define the annotations that a Tenant Owner cannot
                        set for their Namespace resources.
                      properties:
                        denied:
                          items:
                            type: string
                          type: array
                        deniedRegex:
                          type: string
                      type: object
                    forbiddenLabels:
                      description: Define the labels that a Tenant Owner cannot set
                        for their Namespace resources.
                      properties:
                        denied:
                          items:
                            type: string
                          type: array
                        deniedRegex:
                          type: string
                      type: object
                    quota:
                      description: Specifies the maximum number of namespaces allowed
                        for that Tenant. Once the namespace quota assigned to the Tenant
                        has been reached, the Tenant owner cannot create further namespaces.
                        Optional.
                      format: int32
                      minimum: 1
                      type: integer
                  type: object
                networkPolicies:
                  description: Specifies the NetworkPolicies assigned to the Tenant.
                    The assigned NetworkPolicies are inherited by any namespace created
                    in the Tenant. Optional.
                  properties:
                    items:
                      items:
                        description: NetworkPolicySpec provides the specification of
                          a NetworkPolicy
                        properties:
                          egress:
                            description: List of egress rules to be applied to the selected
                              pods. Outgoing traffic is allowed if there are no NetworkPolicies
                              selecting the pod (and cluster policy otherwise allows
                              the traffic), OR if the traffic matches at least one egress
                              rule across all of the NetworkPolicy objects whose podSelector
                              matches the pod. If this field is empty then this NetworkPolicy
                              limits all outgoing traffic (and serves solely to ensure
                              that the pods it selects are isolated by default). This
                              field is beta-level in 1.8
                            items:
                              description: NetworkPolicyEgressRule describes a particular
                                set of traffic that is allowed out of pods matched by
                                a NetworkPolicySpec's podSelector. The traffic must
                                match both ports and to. This type is beta-level in
                                1.8
                              properties:
                                ports:
                                  description: List of destination ports for outgoing
                                    traffic. Each item in this list is combined using
                                    a logical OR. If this field is empty or missing,
                                    this rule matches all ports (traffic not restricted
                                    by port). If this field is present and contains
                                    at least one item, then this rule allows traffic
                                    only if the traffic matches at least one port in
                                    the list.
                                  items:
                                    description: NetworkPolicyPort describes a port
                                      to allow traffic on
                                    properties:
                                      endPort:
                                        description: If set, indicates that the range
                                          of ports from port to endPort, inclusive,
                                          should be allowed by the policy. This field
                                          cannot be defined if the port field is not
                                          defined or if the port field is defined as
                                          a named (string) port. The endPort must be
                                          equal or greater than port. This feature is
                                          in Beta state and is enabled by default. It
                                          can be disabled using the Feature Gate "NetworkPolicyEndPort".
                                        format: int32
                                        type: integer
                                      port:
                                        anyOf:
                                          - type: integer
                                          - type: string
                                        description: The port on the given protocol.
                                          This can either be a numerical or named port
                                          on a pod. If this field is not provided, this
                                          matches all port names and numbers. If present,
                                          only traffic on the specified protocol AND
                                          port will be matched.
                                        x-kubernetes-int-or-string: true
                                      protocol:
                                        default: TCP
                                        description: The protocol (TCP, UDP, or SCTP)
                                          which traffic must match. If not specified,
                                          this field defaults to TCP.
                                        type: string
                                    type: object
                                  type: array
                                to:
                                  description: List of destinations for outgoing traffic
                                    of pods selected for this rule. Items in this list
                                    are combined using a logical OR operation. If this
                                    field is empty or missing, this rule matches all
                                    destinations (traffic not restricted by destination).
                                    If this field is present and contains at least one
                                    item, this rule allows traffic only if the traffic
                                    matches at least one item in the to list.
                                  items:
                                    description: NetworkPolicyPeer describes a peer
                                      to allow traffic to/from. Only certain combinations
                                      of fields are allowed
                                    properties:
                                      ipBlock:
                                        description: IPBlock defines policy on a particular
                                          IPBlock. If this field is set then neither
                                          of the other fields can be.
                                        properties:
                                          cidr:
                                            description: CIDR is a string representing
                                              the IP Block Valid examples are "192.168.1.1/24"
                                              or "2001:db9::/64"
                                            type: string
                                          except:
                                            description: Except is a slice of CIDRs
                                              that should not be included within an
                                              IP Block Valid examples are "192.168.1.1/24"
                                              or "2001:db9::/64" Except values will
                                              be rejected if they are outside the CIDR
                                              range
                                            items:
                                              type: string
                                            type: array
                                        required:
                                          - cidr
                                        type: object
                                      namespaceSelector:
                                        description: "Selects Namespaces using cluster-scoped
                                        labels. This field follows standard label
                                        selector semantics; if present but empty,
                                        it selects all namespaces. \n If PodSelector
                                        is also set, then the NetworkPolicyPeer as
                                        a whole selects the Pods matching PodSelector
                                        in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects all Pods in the Namespaces
                                        selected by NamespaceSelector."
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list
                                              of label selector requirements. The requirements
                                              are ANDed.
                                            items:
                                              description: A label selector requirement
                                                is a selector that contains values,
                                                a key, and an operator that relates
                                                the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key
                                                    that the selector applies to.
                                                  type: string
                                                operator:
                                                  description: operator represents a
                                                    key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists
                                                    and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: values is an array of
                                                    string values. If the operator is
                                                    In or NotIn, the values array must
                                                    be non-empty. If the operator is
                                                    Exists or DoesNotExist, the values
                                                    array must be empty. This array
                                                    is replaced during a strategic merge
                                                    patch.
                                                  items:
                                                    type: string
                                                  type: array
                                              required:
                                                - key
                                                - operator
                                              type: object
                                            type: array
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: matchLabels is a map of {key,value}
                                              pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions,
                                              whose key field is "key", the operator
                                              is "In", and the values array contains
                                              only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                      podSelector:
                                        description: "This is a label selector which
                                        selects Pods. This field follows standard
                                        label selector semantics; if present but empty,
                                        it selects all pods. \n If NamespaceSelector
                                        is also set, then the NetworkPolicyPeer as
                                        a whole selects the Pods matching PodSelector
                                        in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects the Pods matching PodSelector
                                        in the policy's own Namespace."
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list
                                              of label selector requirements. The requirements
                                              are ANDed.
                                            items:
                                              description: A label selector requirement
                                                is a selector that contains values,
                                                a key, and an operator that relates
                                                the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key
                                                    that the selector applies to.
                                                  type: string
                                                operator:
                                                  description: operator represents a
                                                    key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists
                                                    and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: values is an array of
                                                    string values. If the operator is
                                                    In or NotIn, the values array must
                                                    be non-empty. If the operator is
                                                    Exists or DoesNotExist, the values
                                                    array must be empty. This array
                                                    is replaced during a strategic merge
                                                    patch.
                                                  items:
                                                    type: string
                                                  type: array
                                              required:
                                                - key
                                                - operator
                                              type: object
                                            type: array
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: matchLabels is a map of {key,value}
                                              pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions,
                                              whose key field is "key", the operator
                                              is "In", and the values array contains
                                              only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                    type: object
                                  type: array
                              type: object
                            type: array
                          ingress:
                            description: List of ingress rules to be applied to the
                              selected pods. Traffic is allowed to a pod if there are
                              no NetworkPolicies selecting the pod (and cluster policy
                              otherwise allows the traffic), OR if the traffic source
                              is the pod's local node, OR if the traffic matches at
                              least one ingress rule across all of the NetworkPolicy
                              objects whose podSelector matches the pod. If this field
                              is empty then this NetworkPolicy does not allow any traffic
                              (and serves solely to ensure that the pods it selects
                              are isolated by default)
                            items:
                              description: NetworkPolicyIngressRule describes a particular
                                set of traffic that is allowed to the pods matched by
                                a NetworkPolicySpec's podSelector. The traffic must
                                match both ports and from.
                              properties:
                                from:
                                  description: List of sources which should be able
                                    to access the pods selected for this rule. Items
                                    in this list are combined using a logical OR operation.
                                    If this field is empty or missing, this rule matches
                                    all sources (traffic not restricted by source).
                                    If this field is present and contains at least one
                                    item, this rule allows traffic only if the traffic
                                    matches at least one item in the from list.
                                  items:
                                    description: NetworkPolicyPeer describes a peer
                                      to allow traffic to/from. Only certain combinations
                                      of fields are allowed
                                    properties:
                                      ipBlock:
                                        description: IPBlock defines policy on a particular
                                          IPBlock. If this field is set then neither
                                          of the other fields can be.
                                        properties:
                                          cidr:
                                            description: CIDR is a string representing
                                              the IP Block Valid examples are "192.168.1.1/24"
                                              or "2001:db9::/64"
                                            type: string
                                          except:
                                            description: Except is a slice of CIDRs
                                              that should not be included within an
                                              IP Block Valid examples are "192.168.1.1/24"
                                              or "2001:db9::/64" Except values will
                                              be rejected if they are outside the CIDR
                                              range
                                            items:
                                              type: string
                                            type: array
                                        required:
                                          - cidr
                                        type: object
                                      namespaceSelector:
                                        description: "Selects Namespaces using cluster-scoped
                                        labels. This field follows standard label
                                        selector semantics; if present but empty,
                                        it selects all namespaces. \n If PodSelector
                                        is also set, then the NetworkPolicyPeer as
                                        a whole selects the Pods matching PodSelector
                                        in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects all Pods in the Namespaces
                                        selected by NamespaceSelector."
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list
                                              of label selector requirements. The requirements
                                              are ANDed.
                                            items:
                                              description: A label selector requirement
                                                is a selector that contains values,
                                                a key, and an operator that relates
                                                the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key
                                                    that the selector applies to.
                                                  type: string
                                                operator:
                                                  description: operator represents a
                                                    key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists
                                                    and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: values is an array of
                                                    string values. If the operator is
                                                    In or NotIn, the values array must
                                                    be non-empty. If the operator is
                                                    Exists or DoesNotExist, the values
                                                    array must be empty. This array
                                                    is replaced during a strategic merge
                                                    patch.
                                                  items:
                                                    type: string
                                                  type: array
                                              required:
                                                - key
                                                - operator
                                              type: object
                                            type: array
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: matchLabels is a map of {key,value}
                                              pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions,
                                              whose key field is "key", the operator
                                              is "In", and the values array contains
                                              only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                      podSelector:
                                        description: "This is a label selector which
                                        selects Pods. This field follows standard
                                        label selector semantics; if present but empty,
                                        it selects all pods. \n If NamespaceSelector
                                        is also set, then the NetworkPolicyPeer as
                                        a whole selects the Pods matching PodSelector
                                        in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects the Pods matching PodSelector
                                        in the policy's own Namespace."
                                        properties:
                                          matchExpressions:
                                            description: matchExpressions is a list
                                              of label selector requirements. The requirements
                                              are ANDed.
                                            items:
                                              description: A label selector requirement
                                                is a selector that contains values,
                                                a key, and an operator that relates
                                                the key and values.
                                              properties:
                                                key:
                                                  description: key is the label key
                                                    that the selector applies to.
                                                  type: string
                                                operator:
                                                  description: operator represents a
                                                    key's relationship to a set of values.
                                                    Valid operators are In, NotIn, Exists
                                                    and DoesNotExist.
                                                  type: string
                                                values:
                                                  description: values is an array of
                                                    string values. If the operator is
                                                    In or NotIn, the values array must
                                                    be non-empty. If the operator is
                                                    Exists or DoesNotExist, the values
                                                    array must be empty. This array
                                                    is replaced during a strategic merge
                                                    patch.
                                                  items:
                                                    type: string
                                                  type: array
                                              required:
                                                - key
                                                - operator
                                              type: object
                                            type: array
                                          matchLabels:
                                            additionalProperties:
                                              type: string
                                            description: matchLabels is a map of {key,value}
                                              pairs. A single {key,value} in the matchLabels
                                              map is equivalent to an element of matchExpressions,
                                              whose key field is "key", the operator
                                              is "In", and the values array contains
                                              only "value". The requirements are ANDed.
                                            type: object
                                        type: object
                                        x-kubernetes-map-type: atomic
                                    type: object
                                  type: array
                                ports:
                                  description: List of ports which should be made accessible
                                    on the pods selected for this rule. Each item in
                                    this list is combined using a logical OR. If this
                                    field is empty or missing, this rule matches all
                                    ports (traffic not restricted by port). If this
                                    field is present and contains at least one item,
                                    then this rule allows traffic only if the traffic
                                    matches at least one port in the list.
                                  items:
                                    description: NetworkPolicyPort describes a port
                                      to allow traffic on
                                    properties:
                                      endPort:
                                        description: If set, indicates that the range
                                          of ports from port to endPort, inclusive,
                                          should be allowed by the policy. This field
                                          cannot be defined if the port field is not
                                          defined or if the port field is defined as
                                          a named (string) port. The endPort must be
                                          equal or greater than port. This feature is
                                          in Beta state and is enabled by default. It
                                          can be disabled using the Feature Gate "NetworkPolicyEndPort".
                                        format: int32
                                        type: integer
                                      port:
                                        anyOf:
                                          - type: integer
                                          - type: string
                                        description: The port on the given protocol.
                                          This can either be a numerical or named port
                                          on a pod. If this field is not provided, this
                                          matches all port names and numbers. If present,
                                          only traffic on the specified protocol AND
                                          port will be matched.
                                        x-kubernetes-int-or-string: true
                                      protocol:
                                        default: TCP
                                        description: The protocol (TCP, UDP, or SCTP)
                                          which traffic must match. If not specified,
                                          this field defaults to TCP.
                                        type: string
                                    type: object
                                  type: array
                              type: object
                            type: array
                          podSelector:
                            description: Selects the pods to which this NetworkPolicy
                              object applies. The array of ingress rules is applied
                              to any pods selected by this field. Multiple network policies
                              can select the same set of pods. In this case, the ingress
                              rules for each are combined additively. This field is
                              NOT optional and follows standard label selector semantics.
                              An empty podSelector matches all pods in this namespace.
                            properties:
                              matchExpressions:
                                description: matchExpressions is a list of label selector
                                  requirements. The requirements are ANDed.
                                items:
                                  description: A label selector requirement is a selector
                                    that contains values, a key, and an operator that
                                    relates the key and values.
                                  properties:
                                    key:
                                      description: key is the label key that the selector
                                        applies to.
                                      type: string
                                    operator:
                                      description: operator represents a key's relationship
                                        to a set of values. Valid operators are In,
                                        NotIn, Exists and DoesNotExist.
                                      type: string
                                    values:
                                      description: values is an array of string values.
                                        If the operator is In or NotIn, the values array
                                        must be non-empty. If the operator is Exists
                                        or DoesNotExist, the values array must be empty.
                                        This array is replaced during a strategic merge
                                        patch.
                                      items:
                                        type: string
                                      type: array
                                  required:
                                    - key
                                    - operator
                                  type: object
                                type: array
                              matchLabels:
                                additionalProperties:
                                  type: string
                                description: matchLabels is a map of {key,value} pairs.
                                  A single {key,value} in the matchLabels map is equivalent
                                  to an element of matchExpressions, whose key field
                                  is "key", the operator is "In", and the values array
                                  contains only "value". The requirements are ANDed.
                                type: object
                            type: object
                            x-kubernetes-map-type: atomic
                          policyTypes:
                            description: List of rule types that the NetworkPolicy relates
                              to. Valid options are ["Ingress"], ["Egress"], or ["Ingress",
                              "Egress"]. If this field is not specified, it will default
                              based on the existence of Ingress or Egress rules; policies
                              that contain an Egress section are assumed to affect Egress,
                              and all policies (whether or not they contain an Ingress
                              section) are assumed to affect Ingress. If you want to
                              write an egress-only policy, you must explicitly specify
                              policyTypes [ "Egress" ]. Likewise, if you want to write
                              a policy that specifies that no egress is allowed, you
                              must specify a policyTypes value that include "Egress"
                              (since such a policy would not include an Egress section
                              and would otherwise default to just [ "Ingress" ]). This
                              field is beta-level in 1.8
                            items:
                              description: PolicyType string describes the NetworkPolicy
                                type This type is beta-level in 1.8
                              type: string
                            type: array
                        required:
                          - podSelector
                        type: object
                      type: array
                  type: object
                nodeSelector:
                  additionalProperties:
                    type: string
                  description: Specifies the label to control the placement of pods
                    on a given pool of worker nodes. All namespaces created within the
                    Tenant will have the node selector annotation. This annotation tells
                    the Kubernetes scheduler to place pods on the nodes having the selector
                    label. Optional.
                  type: object
                owners:
                  description: Specifies the owners of the Tenant. Mandatory.
                  items:
                    properties:
                      clusterRoles:
                        default:
                          - admin
                          - capsule-namespace-deleter
                        description: Defines additional cluster-roles for the specific
                          Owner.
                        items:
                          type: string
                        type: array
                      kind:
                        description: Kind of tenant owner. Possible values are "User",
                          "Group", and "ServiceAccount"
                        enum:
                          - User
                          - Group
                          - ServiceAccount
                        type: string
                      name:
                        description: Name of tenant owner.
                        type: string
                      proxySettings:
                        description: Proxy settings for tenant owner.
                        items:
                          properties:
                            kind:
                              enum:
                                - Nodes
                                - StorageClasses
                                - IngressClasses
                                - PriorityClasses
                                - RuntimeClasses
                                - PersistentVolumes
                              type: string
                            operations:
                              items:
                                enum:
                                  - List
                                  - Update
                                  - Delete
                                type: string
                              type: array
                          required:
                            - kind
                            - operations
                          type: object
                        type: array
                    required:
                      - kind
                      - name
                    type: object
                  type: array
                podOptions:
                  description: Specifies options for the Pod, such as additional metadata. Optional.
                  properties:
                    additionalMetadata:
                      description: Specifies additional labels and annotations the Capsule operator places on any Service resource in the Tenant. Optional.
                      properties:
                        annotations:
                          additionalProperties:
                            type: string
                          type: object
                        labels:
                          additionalProperties:
                            type: string
                          type: object
                      type: object
                  type: object
                preventDeletion:
                  description: Prevent accidental deletion of the Tenant. When enabled,
                    the deletion request will be declined.
                  type: boolean
                priorityClasses:
                  description: Specifies the allowed priorityClasses assigned to the
                    Tenant. Capsule assures that all Pods resources created in the Tenant
                    can use only one of the allowed PriorityClasses. A default value
                    can be specified, and all the Pod resources created will inherit
                    the declared class. Optional.
                  properties:
                    allowed:
                      items:
                        type: string
                      type: array
                    allowedRegex:
                      type: string
                    default:
                      type: string
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.
                        The requirements are ANDed.
                      items:
                        description: A label selector requirement is a selector that
                          contains values, a key, and an operator that relates the key
                          and values.
                        properties:
                          key:
                            description: key is the label key that the selector applies
                              to.
                            type: string
                          operator:
                            description: operator represents a key's relationship to
                              a set of values. Valid operators are In, NotIn, Exists
                              and DoesNotExist.
                            type: string
                          values:
                            description: values is an array of string values. If the
                              operator is In or NotIn, the values array must be non-empty.
                              If the operator is Exists or DoesNotExist, the values
                              array must be empty. This array is replaced during a strategic
                              merge patch.
                            items:
                              type: string
                            type: array
                        required:
                          - key
                          - operator
                        type: object
                      type: array
                    matchLabels:
                      additionalProperties:
                        type: string
                      description: matchLabels is a map of {key,value} pairs. A single
                        {key,value} in the matchLabels map is equivalent to an element
                        of matchExpressions, whose key field is "key", the operator
                        is "In", and the values array contains only "value". The requirements
                        are ANDed.
                      type: object
                  type: object
                  x-kubernetes-map-type: atomic
                resourceQuotas:
                  description: Specifies a list of ResourceQuota resources assigned
                    to the Tenant. The assigned values are inherited by any namespace
                    created in the Tenant. The Capsule operator aggregates ResourceQuota
                    at Tenant level, so that the hard quota is never crossed for the
                    given Tenant. This permits the Tenant owner to consume resources
                    in the Tenant regardless of the namespace. Optional.
                  properties:
                    items:
                      items:
                        description: ResourceQuotaSpec defines the desired hard limits
                          to enforce for Quota.
                        properties:
                          hard:
                            additionalProperties:
                              anyOf:
                                - type: integer
                                - type: string
                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                              x-kubernetes-int-or-string: true
                            description: 'hard is the set of desired hard limits for
                            each named resource. More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/'
                            type: object
                          scopeSelector:
                            description: scopeSelector is also a collection of filters
                              like scopes that must match each object tracked by a quota
                              but expressed using ScopeSelectorOperator in combination
                              with possible values. For a resource to match, both scopes
                              AND scopeSelector (if specified in spec), must be matched.
                            properties:
                              matchExpressions:
                                description: A list of scope selector requirements by
                                  scope of the resources.
                                items:
                                  description: A scoped-resource selector requirement
                                    is a selector that contains values, a scope name,
                                    and an operator that relates the scope name and
                                    values.
                                  properties:
                                    operator:
                                      description: Represents a scope's relationship
                                        to a set of values. Valid operators are In,
                                        NotIn, Exists, DoesNotExist.
                                      type: string
                                    scopeName:
                                      description: The name of the scope that the selector
                                        applies to.
                                      type: string
                                    values:
                                      description: An array of string values. If the
                                        operator is In or NotIn, the values array must
                                        be non-empty. If the operator is Exists or DoesNotExist,
                                        the values array must be empty. This array is
                                        replaced during a strategic merge patch.
                                      items:
                                        type: string
                                      type: array
                                  required:
                                    - operator
                                    - scopeName
                                  type: object
                                type: array
                            type: object
                            x-kubernetes-map-type: atomic
                          scopes:
                            description: A collection of filters that must match each
                              object tracked by a quota. If not specified, the quota
                              matches all objects.
                            items:
                              description: A ResourceQuotaScope defines a filter that
                                must match each object tracked by a quota
                              type: string
                            type: array
                        type: object
                      type: array
                    scope:
                      default: Tenant
                      description: Define if the Resource Budget should compute resource
                        across all Namespaces in the Tenant or individually per cluster.
                        Default is Tenant
                      enum:
                        - Tenant
                        - Namespace
                      type: string
                  type: object
                runtimeClasses:
                  description: Specifies the allowed RuntimeClasses assigned to the
                    Tenant. Capsule assures that all Pods resources created in the Tenant
                    can use only one of the allowed RuntimeClasses. Optional.
                  properties:
                    allowed:
                      items:
                        type: string
                      type: array
                    allowedRegex:
                      type: string
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.
                        The requirements are ANDed.
                      items:
                        description: A label selector requirement is a selector that
                          contains values, a key, and an operator that relates the key
                          and values.
                        properties:
                          key:
                            description: key is the label key that the selector applies
                              to.
                            type: string
                          operator:
                            description: operator represents a key's relationship to
                              a set of values. Valid operators are In, NotIn, Exists
                              and DoesNotExist.
                            type: string
                          values:
                            description: values is an array of string values. If the
                              operator is In or NotIn, the values array must be non-empty.
                              If the operator is Exists or DoesNotExist, the values
                              array must be empty. This array is replaced during a strategic
                              merge patch.
                            items:
                              type: string
                            type: array
                        required:
                          - key
                          - operator
                        type: object
                      type: array
                    matchLabels:
                      additionalProperties:
                        type: string
                      description: matchLabels is a map of {key,value} pairs. A single
                        {key,value} in the matchLabels map is equivalent to an element
                        of matchExpressions, whose key field is "key", the operator
                        is "In", and the values array contains only "value". The requirements
                        are ANDed.
                      type: object
                  type: object
                  x-kubernetes-map-type: atomic
                serviceOptions:
                  description: Specifies options for the Service, such as additional
                    metadata or block of certain type of Services. Optional.
                  properties:
                    additionalMetadata:
                      description: Specifies additional labels and annotations the Capsule
                        operator places on any Service resource in the Tenant. Optional.
                      properties:
                        annotations:
                          additionalProperties:
                            type: string
                          type: object
                        labels:
                          additionalProperties:
                            type: string
                          type: object
                      type: object
                    forbiddenAnnotations:
                      description: Define the annotations that a Tenant Owner cannot
                        set for their Service resources.
                      properties:
                        denied:
                          items:
                            type: string
                          type: array
                        deniedRegex:
                          type: string
                      type: object
                    forbiddenLabels:
                      description: Define the labels that a Tenant Owner cannot set
                        for their Service resources.
                      properties:
                        denied:
                          items:
                            type: string
                          type: array
                        deniedRegex:
                          type: string
                      type: object
                    allowedServices:
                      description: Block or deny certain type of Services. Optional.
                      properties:
                        externalName:
                          default: true
                          description: Specifies if ExternalName service type resources
                            are allowed for the Tenant. Default is true. Optional.
                          type: boolean
                        loadBalancer:
                          default: true
                          description: Specifies if LoadBalancer service type resources
                            are allowed for the Tenant. Default is true. Optional.
                          type: boolean
                        nodePort:
                          default: true
                          description: Specifies if NodePort service type resources
                            are allowed for the Tenant. Default is true. Optional.
                          type: boolean
                      type: object
                    externalIPs:
                      description: Specifies the external IPs that can be used in Services
                        with type ClusterIP. An empty list means no IPs are allowed.
                        Optional.
                      properties:
                        allowed:
                          items:
                            pattern: ^([0-9]{1,3}.){3}[0-9]{1,3}(/([0-9]|[1-2][0-9]|3[0-2]))?$
                            type: string
                          type: array
                      required:
                        - allowed
                      type: object
                  type: object
                storageClasses:
                  description: Specifies the allowed StorageClasses assigned to the
                    Tenant. Capsule assures that all PersistentVolumeClaim resources
                    created in the Tenant can use only one of the allowed StorageClasses.
                    A default value can be specified, and all the PersistentVolumeClaim
                    resources created will inherit the declared class. Optional.
                  properties:
                    allowed:
                      items:
                        type: string
                      type: array
                    allowedRegex:
                      type: string
                    default:
                      type: string
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.
                        The requirements are ANDed.
                      items:
                        description: A label selector requirement is a selector that
                          contains values, a key, and an operator that relates the key
                          and values.
                        properties:
                          key:
                            description: key is the label key that the selector applies
                              to.
                            type: string
                          operator:
                            description: operator represents a key's relationship to
                              a set of values. Valid operators are In, NotIn, Exists
                              and DoesNotExist.
                            type: string
                          values:
                            description: values is an array of string values. If the
                              operator is In or NotIn, the values array must be non-empty.
                              If the operator is Exists or DoesNotExist, the values
                              array must be empty. This array is replaced during a strategic
                              merge patch.
                            items:
                              type: string
                            type: array
                        required:
                          - key
                          - operator
                        type: object
                      type: array
                    matchLabels:
                      additionalProperties:
                        type: string
                      description: matchLabels is a map of {key,value} pairs. A single
                        {key,value} in the matchLabels map is equivalent to an element
                        of matchExpressions, whose key field is "key", the operator
                        is "In", and the values array contains only "value". The requirements
                        are ANDed.
                      type: object
                  type: object
                  x-kubernetes-map-type: atomic
              required:
                - owners
              type: object
            status:
              description: Returns the observed state of the Tenant.
              properties:
                namespaces:
                  description: List of namespaces assigned to the Tenant.
                  items:
                    type: string
                  type: array
                size:
                  description: How many namespaces are assigned to the Tenant.
                  type: integer
                state:
                  default: Active
                  description: The operational state of the Tenant. Possible values
                    are "Active", "Cordoned".
                  enum:
                    - Cordoned
                    - Active
                  type: string
              required:
                - size
                - state
              type: object
          type: object
      served: true
      storage: true
      subresources:
        status: {}
